Audit Risk Presentation 2 Information Security Audit assurance

Audit & Risk Presentation

2

Information Security & Audit assurance on controls Process standardization and document the processes KCPL’s Risk Management Framework Related Risk Operational risk management & Surveillance Financial Risk Management Risk assessment of critical processes, Risk register and Controls 3

KCPL’s Risk Management Framework • Information Security Management - Risk Based approach Follows ISO 27001: 2005 standard Information security governance Business continuity Technology dimension • Operational risk management and Surveillance - Identify the critical operational processes and risks - associated with them. Preparation of Risk register. Document Controls ( Severity of control depends on the risk appetite) Compliance requirements and reports to the regulator Fraud detection and control Financial Risk Management Internal audit assurance - To ensure established controls to mitigate identified risks, are actually working. - To report non adherence to established controls. - Suggest action plans for correction - Ensure the implementation of suggested action plans - Accounting and financial controls and reporting. - Statutory and Regulatory requirements and fulfillment - Revenue and cost assurance - Fund Management/ Treasury operations 4

Information Security Operational Risk Management & Surveillance Audit assurance on controls Process standardization and document the processes KCPL’s Risk Management Framework Financial Risk Management Risk assessment of critical processes, Risk register and Controls 5

KCPL’s Information Security Management KCPL Information Security Management System Framework 6

KCPL’s Information Security Management Area of Deployment Business applications • Logical access controls • Input / output controls • Procedural controls • Audit trails Databases • Access controls • Data integrity controls Operating systems • Access controls • User management • Password policies • • • Networks • Access controls • Security policies • Management controls • Monitoring controls Processes • Physical access controls • Environmental controls • Physical security • Backup procedures • Asset management • Insurance policies People • Access-cum-identity cards • Privilege and access protocols • Non disclosure agreements • Non compete agreements Audit policies Accounting policies Encryption controls Accounting / audit policies Service packs Security patches 7

KCPL’s Information Security Management Human Resources Controls on Pre- Employment, Post employment and Exit Processes Controls on vendors Training and Awareness of Employees Code of conduct Comprehensive undertaking Admin Physical security Securing offices rooms and Facilities Protection against External and Env. Threats Equipment Maintenance Access Controls KCPL ISMS Incident Management Operations Standard Operating Practices (SOP) Change Management Service Delivery Scalability Physical and Logical Access controls Adherence to compliance Third party Service Delivery Management Compliance BCP Management IT Controls on SW Development, Testing Availability Control in tune with Business Growth Info. Back up Business Continuity Planning Network controls Incident/ Problem Management OS Access Controls Technical Vulnerability Management 8

Information Security – Risk Assessment process Planning Risk Assessment 1. Identify the risks associated with the processes and assets. 1. Identify critical processes and 2. Assess the inherent risk levels by using KCPL- Risk assessment methods. associated assets. 3. Based on the Risk scores determined using the KCPL - Risk 2. Identify Asset (Risk) owners assessment method decide on - Accept, Reduce, Transfer criteria Key Process 3. Risk assessment training to 3. Obtain policy and procedures from the business unit steps 4. List the mitigating controls based on the policy and asset owners procedures from the Risk Owners 5. Calculate the RPNs of residual risks. 4. Plan the risk assessment meetings with individual asset 6. Update the risk register periodically based on incidents, owners changes in business environment etc Document Asset register Responsibility Chief Information Security officer - CISO Periodicity Annual Risk register CISO, Business owners Half yearly Steering committee/ Management reporting ISMS - Internal Audit 1. Present the risk register to the steering committee members. 2. Approval from the steering committee. 1. Prepare the list of controls from the risk register. 2. Send the audit schedule to risk owners 3. Conduct the Internal audit. 4. Prepare a report and communicate the audit findings with the risk owners. 5. Obtain the action plans for improving the system/ processes. 6. Monitor the Implementation of the ISMS improvement projects. 7. Report the significant audit observations to the board members. Approved Risk register Internal audit reports and action plans. CISO. Steering committee Half yearly CISO, Business owners Half yearly 9

Information Security – Internal audit execution Information security internal audit is – Risk based and is conducted by taking the following into consideration • Prepare the audit schedule. • Prepare the audit agenda with the controls to be tested • Conduct the internal audit as per the agreed scope and risk register • Prepare the working papers and submit the report for management comments. • Identify actions plans to improve Information security management 10

Information Security management - Templates IF/ISMS/01. 2/Ver. 1. 1 Audit Report & Checklist Audit start date Category of finding Checklist Analysis of basic cause of non conformity Auditee Signature Process/Dept Correcti ve action to eliminat e basic root cause Clause Deadline for implementati on of corrective action Auditor's Verificatio n of Corrective action and effectiven ess Aditee Description and consequence Date for Closure of Nonconform ity Auditor Signature 11

Information Security management - Templates Preliminary Information Sr. # Activit Asset y ID / Centre Name Risk assessment- Inherent Risk Assessment Magnitu Notion Business Magnitu de of al Proba Impact de of Asset Diffic impact value bility (Includes impact value / ulty if the of the Likelih (appr Risk tangible e. g. if the Impact Threat in Risk Confide loss Vulnera ox. Current ood score monetary Asset owner Integrit Availabi [AV = ID / detec Strate ntiality due to incide bility rating (R = AV Controls C and nony is lity is log 10(10 tion name gy is nts (L) + L + D) the tangible compro +10 I+10 Score compro per risk A)] losses e. g. mised mise (D) mised year) (10 R in reputational) (I) (A) (C) INR) Risk management plan Residual Risk Assessment Asset value / Magnitude of Probability Difficulty in Impact if the impact if the Likelihood (approx. Risk score Notional value of detection [AV = Confidentiality is Integrity is Availability is rating (L) incidents per (R = AV + L + D) the (10 R in INR) C I A log 10(10 +10 ) Score (D) compromised (C) compromised (I) compromise (A) year) ] 12

Information Security Internal audit & Surveillance Audit assurance on controls Process standardization and document the processes KCPL’s Risk Management Framework Financial Risk Management Risk assessment of critical processes, Risk register and Controls 13

KCPL’s Financial Risk Management Accounting of all financial transactions including accruals - Billing to the client – Revenue accounting - Accounting of financial commitments and liabilities - Adherence to generally accepted accounting principals (GAAP) - Monthly closing and reporting. Statutory and Regulatory requirements and fulfillment - Tax Payments and submission of related returns. - Statutory and regulatory fees/ contributions payment. - Intimation and submission of forms/ returns with statutory and regulatory authorities Revenue and cost assurance - To ensure correct billing to clients as per contract. - To ensure all cost obligations are accounted Fund Management - Ensure collection from clients - Ensure funds are invested in most profitable manner - Ensure cash flow management, vendor payment 14

Information Security Operational risk Management & Surveillance Audit assurance on controls Process standardization and document the processes KCPL’s Risk Management Framework Financial Risk Management Risk assessment of critical processes, Risk register and Controls 15

KCPL’s Operational Risk Management Document the processes - Document the process flows. - Prepare the list of processes with the process owners - Document the process flows as they are Identify the risks associated with the processes. - Train the process owners on risk identification. - List the points of failure or possible opportunities for defects - Document the inherent risks. Prepare a risk register with the process owners Document the controls for mitigating the risks. - Standardize the processes - Identify the controls and implement the same for Accept/ Reduce/ Transfer. - Prepare an audit assurance plan to monitor the controls. - Identify the action plans for implementing the same. - Update the Risk register periodically. 16

Mitigation controls – Macro risks Area of Deployment Operations Mitigation Controls • Frauds • Lack of standard operating procedures • Lack of BCP/ DR • Information leakage • Concurrent Audit of CTs > Rs 2 Lakh • Maker <> Checker • Surveillance • E-learning modules (SOPs) • Approval for high value payouts • Access rights • ISO 27001 controls • DR/BCP Area of improvement • E-learning modules Corp registry 17

Mitigation controls – Macro Risks Area of Deployment Human Resources Mitigation Controls Area of improvement • Sabotage • Attrition • Epidemics • Industrial accidents • Referral checks • Access controls • ISO 27001 controls • Structured performance management system • Employee engagement Rewards • Health watch • Facilities far off from Industrial estates • Background check of Employees including temps 18

Mitigation Controls – Macro Risks Area of Deployment Administration Mitigation Controls • Fire hazard • Attack by anti social elements • Grid collapse • Wide spread social unrest • Fire fighting equipment • Fire drills • Fire Insurance • ISO 27001 controls • DG sets with sufficient capacity • Liaison with police • Ability to lodge key resources in the facility • 24 x 7 watch and ward 19

Mitigation Controls - Macro Risks Area of Deployment Information Security • Loss/ Theft of data • Denial of service attacks • Infrastructure failure • Software failure/damage Networks • Data network link failures • Device and software failures • Denial of Service attacks • Sabotage Mitigation Controls • ISO 27001 controls • Change Management • Enterprise class infra • Access controls • Redundant data lines from different service providers • 24 X 7, monitoring of NW traffic by NOC • Restricted super admin rights • Vulnerability assessments Area of improvement • Change Management • Operational Level Agreement – IT & Ops 20

Mitigation controls – Macro risks- Business environment Area of Deployment Business risks Mitigation Controls • Consolidation and consequent attrition (Low Order Booking) • Investment risks • Regulatory risks • • Reduction of AUM Client negotiations Reputation risks Collapse of economy • Diversification into other business activities • Diversification into other emerging economies e. g. ME, East Asia • To agree with minimum fee capping • Restrict to limited period and continuously engage with clients for restoration • Internal controls, Check list approach and compliance adherence process • Proactive client and media communication • Strong media relationship • Pre investment due diligence of investment entity 21

KCPL’s Risk Management Framework Audit assurance on Controls 22

Audit Approach & Methodology Ø Internal Audit carried out in accordance with Auditing and Assurance Standards and Standards on Internal Audit issued by the Institute of Chartered Accountants of India Ø Risk based approach in addition to Transaction Audit Ø Understand the way the management operates and controls the business Ø Identify gaps in controls Ø Suggestions measures on additional control Continuance assessment Audit Comfort Cycle Tests of details Substantive audit evidence Process reviews Final Observations / Report 23

Surveillance SCOPE Prevention Detection Prevention: • To identify risk in process flow • To mitigate internal and external fraud risk • To place controls in the system to filter deviations Detection: • To detect process lapses at operational level • Rule based transaction level, system detection Investigation • To investigate on cases with deviations • To establish legitimacy of transactions detected Deterrence Investigation Deterrence • To apply back rules to the system based on investigations • To analyze data and place controls on potential risk areas 24

Surveillance-Detection & Review Methodology Detection methods adopted : Control Environment: • Study of existing control policies to reinforce the procedures Risk Assessment • Data Mining • Identification of Internal and External threat to control structure • Evaluation and Analysis Control Activities • Procedural recommendations • Periodic procedural assessments Monitoring • Daily transaction monitoring • Compliance of existing controls Transaction review methodology : • • System based logics imbibed to detect transactions Rule based system tracking Manual transaction verification on queued up cases Periodic review and analysis to identify trends Reporting: • • • MIS on volume of transactions queued up and verified during the month Daily reporting to the processing units on caution marked transactions Monthly review on action taken on previous reports 25

Risk Parameters – Surveillance Module d e s s u c s i d e b o T 26

Audit Process • Internal audit being conducted on a concurrent basis by In- house Internal Audit team and External Chartered Accountant Firm • A Risk Assessment report prepared based on audit observations as part of monthly audit report • Review of existing internal control systems and processes to mitigate the risks • • Review of Compliance requirements and Actual compliance Review of Adherence to Generally Accepted Accounting Principles Right method Evaluation Identification Applying Continuous review 27

Audit Universe/scope • • • All divisions are continuously audited based on key parameters, viz. in case of Transfers, key parameters are signature of transferor, stamp duty paid, validity of transfer deed, capturing of investor name and address etc. , likewise for other areas Key parameters are decided based on risk assessment Others factors viz. Control environment, Regulatory requirements, Contractual Obligations etc. define Audit scope as given hereunder: 28

Audit Plan, Frequency and Extent of verification MFS – Commercial Transaction verification Sl. No. Transaction type Frequency Method 1 Purchases >= Rs. 200, 000 Daily Workflow based 100% 2 Redemptions > = Rs. 200, 000 Daily Workflow based 100% 3 Switches > = Rs. 200, 000 Daily Workflow based 100% 4 SIP – Registration Daily Random sample 5 SWP Daily Random sample 6 STP Daily Random sample 7 Rejections Daily Random sample 8 Web trade/channel partner transactions Daily Random sample/ reports comparison 9 FMPs/NFOs As per Issue 10 NSE/BSE transactions Daily Random sample 11 Redemption transactions Co. A/Co. B (< 2 lakhs) Daily Random sample involving 29

Audit Plan, Frequency and Extent of verification MFS – Non-Commercial Transaction verification Sl. No. Transaction type Frequency Method 1 Transmissions Daily 100% 2 POA Daily 100% 3 Pledge/Un-pledge Daily 100% 4 Consolidations Daily 100% 5 Transfers Daily 100% 6 ARN empanelment (applicable funds) Daily Workflow based 100% 7 I-PINs Daily Workflow based 100% 8 Brokerage NCTs Daily Random sample 9 Re-issue/revalidation etc. Daily Random sample 10 So. A to Demat & vice-versa Daily Physicals 100% 11 Triggers Daily Random sample 12 Other NCTs / Bank validations Daily Random sample 13 Fund specific ATM / Easy invest Daily 100% 30

Audit Plan, Frequency and Extent of verification MFS – Batch processes, Reports, MIS etc. Sl. No. Batch processes Frequency Method 1 NAVs Daily Comparative analysis 2 STT, TDS, LOAD (Split register) Daily Test check & controls 3 Dividend (ad hoc/monthly only), DTP Ad hoc / event based Controls & Test check 4 Brokerage Monthly Controls & Test check 5 UCRs Daily Controls & Test check 6 Funding Daily Controls & Test check 7 Exchange Traded Funds Daily 8 Stationery issuance Monthly 9 N F O / F M Ps As per Issue Need-based 10 UCR vs Redemption vs DTR Daily Random funds comparative analysis 11 Bank reconciliation Monthly Random scrutiny 12 Client billing Monthly AUM , Fee, Costs & OPE 13 Compliance review Monthly TAT and random report scrutiny 31

Audit Plan, Frequency and Extent of verification Corporate Registry # 1 Key Areas Frequency Sample Size Risk Assessment Report based audit observations Every Month - Assessment of service standards Every Month 100% Verification of all processes viz. transfers, demat, remat, correspondence etc. 3 Share Capital Reconciliation Every Month All Client Companies are covered twice in a year 4 Pre-audit of Transfer Deeds Concurrently 100% verifications of TDs of value above INR. 25, 000 and random verification of other cases 5 Pre-audit of Demat Request Forms Concurrently 100% verifications of DRFs of value above INR. 25, 000 and random verification of other cases 6 Pre-audit of Remat Request Forms Concurrently 100% verification 7 Pre-audit of Transmission/ Deletion of name/ Consolidation etc. Concurrently 100% verification 8 Verification of re-dispatch of returned undelivered Share Certificates Concurrently 100% verification of Share Certificates of value above INR. 50, 000 9 Verification of re-dispatch of returned undelivered Dividend Warrants Concurrently 100% verification of dividend warrants of value above INR. 5, 000 10 Verification of re-validation of Dividend Warrants Concurrently 100% verification of dividend warrants of value above INR. 5, 000 11 Audit of Correspondence Every Month 100% verification for Key subject areas 12 IPO Audit Event Based 100% verification 2 32

Audit Plan, Frequency and Extent of verification Surveillance SURVEILLANCE DATA COLLECTION METHODS DATA SOURCE SURVEILLANCE MODULE * TRANSACTION DATA VIDEO SURVEILLANCE (CAMERA LINKS) METHOD CASE SCRUTINY AND DATA ANALYSIS TRANSACTION/DATA ANALYSIS LIVE AND RECORDED VIDEO FOOTAGE FREQUENCY DAILY BASIS ADHOC BASED ON PARAMETER LOGICS PERIODIC 100% verification of transactions falling under the following parameters SL. NO. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 DATA TYPE Post Data PARAMETERS Dormant Cases Returned Undelivered Cases STOP Cases Frequent Rejections Mismatch investor city / bank city Mismatch investor city/ requested branch city Spurt Cases Address match with Client/R&T Dividend re-issue with NCT Payout without bank details Caution marked cases by Surveillance Team Identified addresses Pre Data RUD - Deceased Frequent Rejections No Address • Online application notifying the surveillance team with the transactions in the form of triggers in a PRE & POST-DATA processing scenarios. The module/application applies 15 basic parameters for instant data skimming and highlighting the ones requiring further scrutiny 33

Audit Plan, Frequency and Extent of verification In addition to audit of Operations, audit of Books of Account, Contractual obligations viz. Payroll and Bills and adherence to Statutory & Regulatory Compliances are also verified. Further, on requirement basis, review of various processes are also taken up to identify gaps, if any and to take remedial actions # Audit/Review of … Covers … Frequency of verification 1 Books of Account Cash Book, Bank Book, Journal, Ledgers etc. Quarterly 2 Bills Pre-audit of bills for value Rs. 50, 000 & above Monthly Post-audit of bills for value below Rs. 50, 000 Quarterly 3 Payroll v Verification of joining formalities of new staff and updation of their salary components in HRIS system v. Pre-Audit of Full and Final Settlement of resigned staff v. Verification of eligibility criteria and updation in the system relating to Leave Travel Allowance and Salary Advance Monthly 4 Compliance Overview v Adherence to Statutory compliance requirement viz. Remittances of Provident Fund, Professional Tax, Employee State Insurance etc. and submission of returns to Income Tax, Registrar of Companies etc. v. Adherence to Regulatory compliance requirement viz. submission of reports to SEBI, DP etc. Monthly 5 Process Key areas on request from the Division Heads Upon requirement 34

Audit Notification, Reporting and Follow ups MFS - MIS reports to clients • A Monthly report is shared with the clients, giving the : Ø Volume of transactions verified during the month Ø Deviations / errors noticed during the month Ø Comparative analysis on the month-on-month transactions verified and the deviations noticed Ø Various other aspects including TAT Compliance for regulatory and statutory reports, Tax deductions, Remittances etc. 35

Audit Notification, Reporting and Follow ups Audit Notification v Notification for audits are done by sending emails to the concerned staff of the divisions subsequent to personal/ telecon interactions with them. Though no specified templates are used for notification, the background, objectives, scope and information requirements are stated in the email Audit Reporting on Initial Audit Observation v Initial audit observations are sent to the auditee through emails for discussion and feedback Audit Follow ups v Audit Follow ups for information or for reply/feedback to Initial Audit Observations are done by personal interaction/telecon/through emails Final Audit Report v Final Audit Report after incorporation of Management Comments are shared with the Concerned Staff 36

37